CVE Feed

    Dashboard / CVE / CVE-2011-2900

    CVE-2011-2900

    Stack-based buffer overflow in the (1) put_dir function in mongoose.c in Mongoose 3.0, (2) put_dir function in yasslEWS.c in yaSSL Embedded Web Server (yasslEWS) 0.2, and (3) _shttpd_put_dir function in io_dir.c in Simple HTTPD (shttpd) 1.42 allows remote attackers to execute arbitrary code via an HTTP PUT request, as exploited in the wild in 2011.

    Published:Aug 5, 2011
    Last Modified:Apr 11, 2025
    EPS:Aug 5, 2011
    EPSS Score:0.51206
    CVSS Score:7.5

    Affected Products

    Vendor
    Shttpd
    Product
    Shttpd
    Vendor
    Valenok
    Product
    Mongoose
    Vendor
    Yassl
    Product
    Yasslews

    Exploits

    https://www.exploit-db.com/exploits/17658https://www.exploit-db.com/exploits/17669

    References

    http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065273.html
    http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065505.html
    http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065537.html
    http://secunia.com/advisories/45464
    http://secunia.com/advisories/45902
    http://securityreason.com/securityalert/8337
    http://www.openwall.com/lists/oss-security/2011/08/03/5
    http://www.openwall.com/lists/oss-security/2011/08/03/9
    http://www.securityfocus.com/bid/48980
    https://code.google.com/p/mongoose/source/detail?r=556f4de91eae4bac40dc5d4ddbd9ec7c424711d0
    https://exchange.xforce.ibmcloud.com/vulnerabilities/68991
    http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065273.html
    http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065505.html
    http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065537.html
    http://secunia.com/advisories/45464
    http://secunia.com/advisories/45902
    http://securityreason.com/securityalert/8337
    http://www.openwall.com/lists/oss-security/2011/08/03/5
    http://www.openwall.com/lists/oss-security/2011/08/03/9
    http://www.securityfocus.com/bid/48980
    https://code.google.com/p/mongoose/source/detail?r=556f4de91eae4bac40dc5d4ddbd9ec7c424711d0
    https://exchange.xforce.ibmcloud.com/vulnerabilities/68991

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High